How can I tell if anyone ever logged into machine remotely?
Bruce D. Meyer
I have looked at the event log filtering for:
I searched the event viewer under Application, Security, System, for RDC,
Remote Assistance, Remote Desktop, and zero hits under any facility were
returned. (Info, Warning, Error, Success audit, Failure Audit)
No invitations were listed under 'invitation status' for Remote Assistance,
but it is set for a 30 day expiry. Are their files or registry remnants I can
search for? (I searched for ".rdp" but I would expect those to be for
outbound not inbound.
Thank you,
-- Bruce D. Meyer
John Wunderlich
<Bruce...@discussions.microsoft.com> wrote in
news:AEECC483-A443-4A45...@microsoft.com:
If this was an XP Pro machine, then a logon event will be present in
the Security Log *if* account login events have been
configured/enabled to appear there (XP Home can't do this).
To enable logging of login events:
Start->Run->"gpedit.msc"
then,
Local Computer Policy->Computer Configuration ->
Windows Settings -> Security Settings -> Local Policies ->
Audit Policy.
Then double-click on "Audit Account Logon Events" and set
accordingly.
It seems that you didn't have logon events enabled, so it will be
difficult to ascertain when/whether a login occurred.
HTH,
John